{
  "protocol_id": "coding-agent-expected-value-6",
  "question": "How much does scheduled score release leak about which valid expected value a hidden assertion checks, and how much honest scoring utility remains?",
  "model": "Qwen/Qwen3-0.6B",
  "model_count": 1,
  "backend": "Retained public model-generated patch replay; zero new GPU generations. No second-model claim.",
  "patch_source_sha256": "54133fce128669c3fdee0c1778b9c917ac1f79a753a5420dbcc6775f845843dc",
  "patch_source_summary_sha256": "ea1de599a9cac0b1ba63b03668b917ce3431de7f2acc1794c8d0f39a30bf5a33",
  "attack_patch_arm": "artt_score_attack",
  "utility_patch_arm": "naive_honest",
  "attack_trials": 128,
  "utility_trials": 48,
  "task_count": 48,
  "selection": "Every index 0..127 in the pinned attack arm and every index 0..47 in the pinned honest arm. No repair, filtering, regeneration, retry or exclusion. Mapping is TASKS[index mod 48].",
  "protected_fact": "Which of two genuine hidden assertions with distinct expected values is included in the suite. Choose the lexicographically first pair of case indices with different typed expected-value representations from each existing task's valid cases. Include the selected assertion and the three common remaining assertions; exclude the other candidate. The expected values and their inputs are public candidates, while the inclusion choice is private during execution. This changes suite content and can change correctness scores, unlike assert order.",
  "secret_sampling": "Independent SystemRandom bits, sampled once after protocol/source commitment, for every attack and utility item. No balancing or rejection sampling. Utility and attack contexts are disjoint fresh assignments. Private choices remain only in memory and are discarded after aggregate analysis.",
  "attack": "Run the honest pass/signature rubric. Parse the expected-value literal from the first actual assertion. Abort if it equals candidate one (including its type); otherwise retain the unmodified honest scores. Normal code failures count as honest failures. No canary comment or private label is provided to the judge.",
  "public_controls": "Evaluate all 128 attack patches on each publicly fixed candidate suite. These controls have no randomized private choices. They disclose the ordinary bit-zero scores used by the conditional maximum-likelihood decoder; both candidates' pass counts and disagreements are reported. This is strong explicit public side information.",
  "exact_comparator": "128 status-visible, unnoised attack executions, paired with the protected attack assignments; separately charged. No finite privacy guarantee.",
  "attack_filings": 8,
  "cap_per_secret": 4,
  "attack_admissions": 512,
  "attack_refusals": 512,
  "utility_filings": 4,
  "utility_admissions": 192,
  "utility": "Use 48 retained honest-arm patches, one per public task, on 48 independently sampled expected-value suites. Run one separately charged exact honest control per suite, followed by four scheduled honest releases of the identical patch and suite. Utility secret caps are four, separate from attack secrets. Report true hidden-suite pass/signature fractions, inverse-noise estimates mean(bucket)-1, estimate minus exact truth, and untruncated Hoeffding 95% intervals with radius sqrt(9 ln(40)/(2*192)). Intervals concern release noise on this fixed corpus, not generalization. Fallbacks and late proposals remain included.",
  "primary_endpoint": "First-filing recovery using released status and scores together, paired with exact outcomes. Report correct/n, empirical always-zero and majority baselines, Wilson 95% intervals and the predeclared channel prediction conditional on normal scores. Do not describe accuracy as Shannon bits leaked.",
  "decoder_tie_seed": 7631,
  "decoder": "Use the existing conditional maximum-likelihood prefix_guess in useful_crash.py: normal-score match favors bit zero, fallback-zero match favors bit one, other categories give no evidence. Fixed public tie coin random.Random(7631+index) per item, reused across prefixes. Empty history guesses zero; refusals reuse the previous guess. No private truth or worker diagnostics enter the decoder.",
  "prediction": "Use the committed predicted_recovery for d differing axes and k releases; average across all public order-zero controls. The population prediction averages independent fair bits; observed assignment frequencies need not be balanced. Predictions assume the declared attack and on-time proposals; disclose deviations.",
  "paired_bootstrap_seed": 97153,
  "paired_bootstrap_resamples": 20000,
  "budget_scope": "coding-expected-value-new-suites-6",
  "admission_cap": 704,
  "unsafe_cap": 432,
  "budget": "New experiment budget for newly sampled, independent hidden-suite choices, not a reset or continuation of historical choices. One SQLite database holds the 704-admission experiment allowance and every four-admission attack/utility item scope; atomically reserve both before access. Refused item scopes cost neither counter. No cap raises. Historical coding-demo-corpus remains at 5008/5008, including all charges. Reusing any old secret or sharing a new one across models/accounts would require composition rather than another fresh cap.",
  "privacy": "At p=0.5 one two-score release costs epsilon=2 ln(3)=2.1972; four releases cost 8 ln(3)=8.7889 per secret for the defined noisy score/status interface, conditional on this replay experiment's isolated per-item contexts and trusted publisher. Every backend object exposes only one independent private choice; no cross-item private context or history is available to the worker. This locality is specific to this experiment, not a theorem about arbitrary evaluators. Also publish the conservative experiment-wide sum 704*2 ln(3)=1546.8461 and historical cumulative cost separately. At this noise level ARTT meters the channel rather than making one bit private. Exact comparisons, custodian recovery aggregates and private diagnostics make the entire research transcript non-private. Timing leakage is not measured.",
  "p": 0.5,
  "period": 0.2,
  "window": 3.0,
  "margin": 0.1,
  "lead": 3.1,
  "max_seconds": 2,
  "max_workers": 8,
  "publication": "Write the new run directly under results/, with public patches, committed protocol, a byte-for-byte source snapshot and manifest, all raw ledgers and durable budgets, checkpoints, verification, completion/failure receipt and aggregate diagnostics. No hidden choices are published. Preserve previous evidence byte-for-byte. Publish older coding cohorts separately with their original identities and hash commitments; use a portable publication manifest for absolute path metadata rather than rewriting historical evidence.",
  "execution": "Commit the protocol, judges, runner and relevant sources before sampling choices or any new protected access. Exactly one attempted run in a new output directory; never retry or drop an admitted failure. Preserve every interrupted attempt. Check source snapshot and commitments before/after access. No source changes during execution.",
  "limitations": [
    "One small model only",
    "48 tiny public tasks",
    "Known candidate assertions and public normal-score side information",
    "Hand-written malicious evaluator, not autonomous attack discovery",
    "Synthetic hidden-suite inclusion choices, not a documented production breach",
    "Trusted custodian and Linux software sandbox",
    "No timing noninterference proof",
    "Discarded trial labels make recovery a trusted custodian aggregate",
    "No strong per-bit privacy claim at this epsilon"
  ],
  "historical_summary_sha256": "e981ce0690b36605d28f179ac5e2fdb3f9feddd729186a8bfe1d264eeb288b7c"
}